Re: fgets()/fgetss() BC break in HEAD
| From: | Zeev Suraski | Date: | Thu, 16 Nov 2006 07:16:51 +0000 |
| Subject: | Re: fgets()/fgetss() BC break in HEAD | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-26630@lists.php.net to get a copy of this message | ||
At 13:04 15/11/2006, Sara Golemon wrote:
ceo@l-i-e.com wrote:Sara, My IQ is higher than 12, and I don't see how defensive coding could have defended against this BC break. This code is missing error checking, but that could be quite reasonable (e.g. if you check ahead of time that the file is big enough to match the format you're expecting - so it's not perfect, but it's quite reasonable). But even if it did have error checking, it would look something like this: $field_X = fgets($file, 10); if (strlen($field_X) != 9) {On Tue, November 14, 2006 2:59 pm, Sara Golemon wrote:Sorry, I meant to say "Noone with an IQ higher than twelve is relying on this."keeping. I'll lay money that NOONE is relying on this, and I challenge any of you to prove me wrong on that count.Errrr. You may want to re-think that bet... Surely somebody out there has: <?php $field_X = fgets($file, 10); //get the next 9 bytes $field_Y = fgets($file, 4); //get the next 3 bytes ?>
barf();} So, after the BC break, it'd barf. There's really no way to protect against this BC break, and it's pretty clear this behavior is being relied upon.
That's fine by me, but I think it's a different issue. The BC break should be reverted irregardless... ZeevOr change the docs and the variable name to something other than maxchars is a perfect solution. :-)Yes, and that's what I said both in this thread and on IRC before the thread started.